Reel
Gaining Access
Nmap scan:
$ nmap -p- --min-rate 5000 -Pn 10.129.76.206
Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-16 09:29 +08
Nmap scan report for 10.129.76.206
Host is up (0.025s latency).
Not shown: 65527 filtered tcp ports (no-response)
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
25/tcp open smtp
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
593/tcp open http-rpc-epmap
49159/tcp open unknownInteresting ports that are open, as both SMTP and FTP are present.
FTP Anonymous Login
This FTP instance allows for anonymous logins:
We can download all of these files here. The readme.txt file tells us that the first step is phishing.
The AppLocker.docx file just states that AppLocker is in place:
The last file cannot be opened for some reason. The most interesting thing about it is the metadata extracted with exiftool:
We have one email here, and it's likely that we need to send our RTF file to nico.
CVE-2017-0199 RTF Exploit
This box is quite old and came out back in 2018, so any public exploits used will have to come from around that time. I googled for 'RTF CVE Exploits', and found quite a few. There was one in 2023, but obviously it isn't the intended attack vector.
I came across this article detailing about an RCE exploit in Microsoft Office using RTF files:
Googling for PoCs for this exploit leads me to this somewhat popular repository:
Following the instructions, we can first generate a payload using msfvenom. Earlier, we saw that AppLocker is in place for most executables and scripts, and this exploit allows multiple other methods of getting RCE, such as generating a hta file.
We can host this file on our own Python HTTP server. Then, generate the RTF file required:
Afterwards, we just need to use sendEmail with the file attached.
I tried this a few times, and it seems to only work when we use the -x 0 flag instead. When changed, we can get a reverse shell as the user:
Privilege Escalation
Tom Creds
Within the user's directory, there's a cred.xml file present:
When viewed, it contains credentials for the tom user:
Since this is a Powershell generated XML file, we can use the Import-Clixml cmdlet to decode it.
Using this password, we can ssh in as tom.
Bloodhound -> WriteOwner
The user tom is part of multiple AD groups:
The desktop also contains some interesting files:
So there's already a csv file present with the ACLs we need. I transferred file back to my machine via smbserver.py, and opened it in libreoffice. Then, I searched for the user tom to see if they had any permissions.
I found that our current user has WriteOwner permissions over the user claire.
This would mean that tom can add permissions over claire, of which we don't have any yet. To abuse this, we first need to set tom as the owner of the ACLs over claire using PowerView.
Oddly, there's a copy of PowerView on the machine already:
I originally tried copying over my own copy and executing it, but AppLocker kept blocking me. However, using the already present script works. We can then abuse this ACL by setting tom as the object owner and changing passwords of claire:
Afterwards, we can ssh in as claire using this password.
WriteDacl -> Admin Creds
The user claire is part of another group.
Checking back on the Bloodhound output, we see that claire has WriteDacl permissions over the Backup Admins group:
This means that the user claire can modify the ACLs of the group, which includes adding and removing users.
We can then check the ACLs of the C:\users\administrator directory:
We can view the files present in the Desktop, but we cannot read the root flag.
The Backup Scripts folder contains some interesting files, and one contains the admin password:
We can then login as the administrator user:
Rooted!
Last updated